CVE-2026-96636

A flaw was found in Pillow. A remote attacker could exploit this vulnerability by enticing an application or user to process a specially crafted multi-frame image file. Because decompression bomb protections are bypassed when navigating subsequent image frames, decoding the file allocates excessive system memory, resulting in a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having Moderate security impact because successful exploitation leads strictly to denial of service via memory exhaustion, without enabling data corruption or remote code execution. In typical Red Hat deployments containing Python imaging components, applications are exposed only when explicitly configured to ingest and navigate through multi-frame images supplied by untrusted external sources. Because default system operations do not automatically iterate over secondary frames in such formats, the risk remains restricted to specific image-processing workloads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.